Branch was auto-updated.

dist/escu/app.manifest

@@ -5,7 +5,7 @@
     "id": {
       "group": null, 
       "name": "DA-ESS-ContentUpdate", 
-      "version": "3.57.0"
+      "version": "3.58.0"
     }, 
     "author": [
       {

dist/escu/default/app.conf

@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 11659
+build = 12012
 
 [triggers]
 reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple
 
 [launcher]
 author = Splunk
-version = 3.57.0
+version = 3.58.0
 description = Explore the Analytic Stories included with ES Content Updates.
 
 [ui]

dist/escu/default/collections.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-01-24T23:14:44 UTC
+# On Date: 2023-02-07T22:09:12 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/content-version.conf

@@ -1,2 +1,2 @@
 [content-version]
-version = 3.57.0
+version = 3.58.0

dist/escu/default/es_investigations.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-01-24T23:14:44 UTC
+# On Date: 2023-02-07T22:09:12 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/macros.conf

@@ -1,14 +1,10 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-01-24T23:14:44 UTC
+# On Date: 2023-02-07T22:09:12 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
 
-[detect_risky_spl_using_pretrained_ml_model_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
 [okta_risk_threshold_exceeded_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -81,10 +77,6 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
-[splunk_xss_in_monitoring_console_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
 [splunk_xss_in_save_table_dialog_header_in_search_page_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -93,7 +85,7 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
-[abnormally_high_number_of_cloud_security_group_api_calls_filter]
+[aws_concurrent_sessions_from_different_ips_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
@@ -125,10 +117,6 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
-[aws_cross_account_activity_from_previously_unseen_account_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
 [aws_defense_evasion_delete_cloudtrail_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -185,6 +173,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[aws_high_number_of_failed_authentications_for_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_high_number_of_failed_authentications_from_ip_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [aws_iam_accessdenied_discovery_events_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -229,6 +225,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[aws_new_mfa_method_registered_for_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_password_policy_changes_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [aws_saml_access_by_provider_user_and_principal_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -241,6 +245,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[aws_successful_console_authentication_from_multiple_ips_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [aws_successful_single_factor_authentication_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -261,6 +269,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[azure_ad_concurrent_sessions_from_different_ips_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [azure_ad_external_guest_user_invited_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -269,6 +281,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[azure_ad_high_number_of_failed_authentications_for_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[azure_ad_high_number_of_failed_authentications_from_ip_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [azure_ad_multi_factor_authentication_disabled_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -289,6 +309,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[azure_ad_new_mfa_method_registered_for_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [azure_ad_privileged_role_assigned_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -305,6 +329,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[azure_ad_successful_authentication_from_different_ips_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [azure_ad_successful_powershell_authentication_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -341,18 +369,6 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
-[circle_ci_disable_security_step_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[cloud_api_calls_from_previously_unseen_user_roles_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[cloud_compute_instance_created_by_previously_unseen_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
 [cloud_compute_instance_created_in_previously_unused_region_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -365,10 +381,6 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
-[cloud_instance_modified_by_previously_unseen_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
 [cloud_provisioning_activity_from_previously_unseen_city_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -465,10 +477,6 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
-[gsuite_drive_share_in_external_email_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
 [gsuite_email_suspicious_attachment_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -1401,10 +1409,6 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
-[dllhost_with_no_command_line_arguments_with_network_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
 [dns_exfiltration_using_nslookup_app_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -2209,6 +2213,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[lolbas_with_network_traffic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [macos_lolbin_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3245,6 +3253,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_data_destruction_recursive_exec_files_deletion_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_defacement_modify_transcodedwallpaper_file_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3361,6 +3373,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_export_certificate_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_file_transfer_protocol_in_non_common_process_path_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3657,10 +3673,22 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_powershell_cryptography_namespace_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_powershell_disable_http_logging_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_powershell_export_certificate_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_powershell_export_pfxcertificate_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_powershell_iis_components_webglobalmodule_usage_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3793,6 +3821,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_scheduled_task_with_highest_privileges_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_schtasks_create_run_as_system_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3845,6 +3877,38 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_spearphishing_attachment_connect_to_none_ms_office_domain_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_spearphishing_attachment_onenote_spawn_mshta_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_steal_authentication_certificates_certificate_issued_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_steal_authentication_certificates_certificate_request_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_steal_authentication_certificates_certutil_backup_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_steal_authentication_certificates_cs_backup_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_steal_authentication_certificates_export_certificate_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_steal_authentication_certificates_export_pfxcertificate_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_steal_or_forge_kerberos_tickets_klist_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3913,10 +3977,6 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
-[windows_vulnerable_driver_loaded_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
 [windows_wmi_impersonate_token_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4005,6 +4065,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[detect_risky_spl_using_pretrained_ml_model_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [email_attachments_with_lots_of_spaces_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4077,6 +4141,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[splunk_xss_in_monitoring_console_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [suspicious_email_attachment_extensions_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4097,6 +4165,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[abnormally_high_number_of_cloud_security_group_api_calls_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [amazon_eks_kubernetes_cluster_scan_detection_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4105,6 +4177,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[aws_cross_account_activity_from_previously_unseen_account_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [aws_detect_attach_to_role_policy_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4125,6 +4201,22 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[circle_ci_disable_security_step_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[cloud_api_calls_from_previously_unseen_user_roles_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[cloud_compute_instance_created_by_previously_unseen_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[cloud_instance_modified_by_previously_unseen_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [detect_aws_console_login_by_new_user_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4165,6 +4257,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[gsuite_drive_share_in_external_email_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [gsuite_suspicious_calendar_invite_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4205,10 +4301,18 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[detect_suspicious_processnames_using_a_pretrained_model_in_dsdl_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [detection_of_tools_built_by_nirsoft_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[dllhost_with_no_command_line_arguments_with_network_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [exchange_powershell_abuse_via_ssrf_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4293,10 +4397,18 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_driver_inventory_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_java_spawning_shells_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_vulnerable_driver_loaded_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [winrm_spawning_a_process_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4590,6 +4702,10 @@ description = This macro limits the output to only domains that are in the brand
 definition = lookup update=true brandMonitoring_lookup domain as urls OUTPUT domain_abuse | search domain_abuse=true
 description = This macro limits the output to only domains that are in the brand monitoring lookup file
 
+[certificateservices_lifecycle]
+definition = (source=XmlWinEventLog:Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational OR source=XmlWinEventLog:Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational)
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
 [circleci]
 definition = sourcetype=circleci
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
@@ -4618,6 +4734,10 @@ description = customer specific splunk configurations(eg- index, source, sourcet
 definition = sourcetype=aws:cloudwatchlogs:vpcflow
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
 
+[driverinventory]
+definition = sourcetype=PwSh:DriverInventory
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
 [dynamic_dns_providers]
 definition = lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True
 description = This macro limits the output of the query field to dynamic dns domains. It looks up the domains in a file provided by Splunk and one intended to be updated by the end user.
@@ -5096,7 +5216,7 @@ definition = index=_internal sourcetype=splunk_web_access
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
 
 [splunkd_webx]
-definition = index=_internal sourcetype=access_combined_wcookie
+definition = index=_internal sourcetype=splunk_web_access
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
 
 [splunkda]
@@ -5136,7 +5256,7 @@ definition = lookup update=true lookup_uncommon_processes_default process_name a
 description = This macro limits the output to processes that have been marked as uncommon
 
 [windows_shells]
-definition = (Processes.process_name=cmd.exe OR Processes.process_name=powershell.exe)
+definition = (Processes.process_name=cmd.exe OR Processes.process_name=powershell.exe OR Processes.process_name=pwsh.exe OR Processes.process_name=sh.exe OR Processes.process_name=bash.exe OR Processes.process_name=wscript.exe OR Processes.process_name=cscript.exe)
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
 
 [wineventlog_application]

dist/escu/default/transforms.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-01-24T23:14:44 UTC
+# On Date: 2023-02-07T22:09:12 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -10,6 +10,11 @@ filename = __mlspl_detect_suspicious_dns_txt_records_using_pretrained_model_in_d
 case_sensitive_match = false
 # description = Detect suspicious DNS txt records using Pretrained Model in DSDL
 
+[__mlspl_detect_suspicious_processnames_using_pretrained_model_in_dsdl]
+filename = __mlspl_detect_suspicious_processnames_using_pretrained_model_in_dsdl.mlmodel
+case_sensitive_match = false
+# description = Detect a suspicious processname using Pretrained Model in DSDL
+
 [__mlspl_pretrained_dga_model_dsdl]
 filename = __mlspl_pretrained_dga_model_dsdl.mlmodel
 case_sensitive_match = false

dist/escu/default/workflow_actions.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-01-24T23:14:44 UTC
+# On Date: 2023-02-07T22:09:12 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/lookups/__mlspl_detect_suspicious_processnames_using_pretrained_model_in_dsdl.mlmodel

@@ -0,0 +1,2 @@
+algo,model,options
+MLTKContainer,"{""__mlspl_type"": [""mltkc.MLTKContainer"", ""MLTKContainer""], ""dict"": {""endpoint_url"": ""https://localhost:58216"", ""out_params"": {""params"": {""mode"": ""stage"", ""algo"": ""detect_suspicious_processnames_using_pretrained_model_in_dsdl""}, ""args"": [""label"", ""text""], ""target_variable"": [""label""], ""feature_variables"": [""text""], ""model_name"": ""detect_suspicious_processnames_using_pretrained_model_in_dsdl"", ""algo_name"": ""MLTKContainer"", ""mlspl_limits"": {""handle_new_cat"": ""default"", ""max_distinct_cat_values"": ""100"", ""max_distinct_cat_values_for_classifiers"": ""100"", ""max_distinct_cat_values_for_scoring"": ""100"", ""max_fit_time"": ""600"", ""max_inputs"": ""100000"", ""max_memory_usage_mb"": ""4000"", ""max_model_size_mb"": ""30"", ""max_score_time"": ""600"", ""use_sampling"": ""true""}, ""kfold_cv"": null}, ""feature_variables"": [""text""], ""target_variable"": ""label""}}","{""params"": {""mode"": ""stage"", ""algo"": ""detect_suspicious_processnames_using_pretrained_model_in_dsdl""}, ""args"": [""label"", ""text""], ""target_variable"": [""label""], ""feature_variables"": [""text""], ""model_name"": ""detect_suspicious_processnames_using_pretrained_model_in_dsdl"", ""algo_name"": ""MLTKContainer"", ""mlspl_limits"": {""handle_new_cat"": ""default"", ""max_distinct_cat_values"": ""100"", ""max_distinct_cat_values_for_classifiers"": ""100"", ""max_distinct_cat_values_for_scoring"": ""100"", ""max_fit_time"": ""600"", ""max_inputs"": ""100000"", ""max_memory_usage_mb"": ""4000"", ""max_model_size_mb"": ""30"", ""max_score_time"": ""600"", ""use_sampling"": ""true""}, ""kfold_cv"": null}"